> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/windows-priv-esc/pktmon-packet-capture-windows.md).

# pktmon Packet Capture Windows

* pktmon is a native binary found on Windows 10 systems
* Can capture packets based on port number
* Binary found on all post Win 10 October 18 update
* Binary with pcap conversion ability found on all Win 10 2004 (May 2020 update)
* Packet Capture will be saved in .etl format, convert it to a pcap --> <https://github.com/microsoft/etl2pcapng/>

### Capture Packet Process

* View the filters saved on the machine first (if any)

```
pktmon filter list
```

* Create your own filters

```
pktmon filter add -t TCP -p 8080 -i 10.10.120.1
pktmon filter add -t UDP -p 69 
```

* Capture Packets

```
pktmon start --etw -po -f output.etl
pktmon stop 
```

* Convert if the system is post required updated

```
pktmon pcapng input.etl -o output.etl
```